rem’s Twitter Archive—№ 57,396

Trying to work out if it's possible to set a csrf token in an xhr request (rather than in source)—anyone done this? Or know of alternatives?